Executive brief
The RabbitMQ amqp091-go library is a Go client for connecting to RabbitMQ message brokers. Prior to version 1.13.0, synchronous notification delivery could block the reader goroutine if application channels were full or unbuffered, causing missed heartbeats, connection stalls, and disconnections that disrupt message processing and broker connectivity.
Technical details
The vulnerability is a deadlock condition in the Go AMQP 0.9.1 client library. Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, and connection block notifications to application-provided channels without timeouts. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. Under burst event scenarios, this causes connection stalls, missed heartbeats, deadlocks, and disconnections. The fix in version 1.13.0 adds a 5-second timeout to notification sends to prevent reader goroutine blocking.
Affected products
- RabbitMQ amqp091-go prior to 1.13.0
Timeline
- 2026-09-16: disclosed
- 2026-06-16: patched: Version 1.13.0 released with fix